rancher/rancher · error

err.Error()

Error message

err.Error()

What it means

ServeHTTP resolves the caller's service account and its machine plan secret via findSA before dispatching to any connect endpoint. NotFound and errRetrievalInvalidated are deliberately mapped to 401 (unknown or invalidated token); this 500 is reserved for any other findSA error - informer cache failures, apiserver errors, or unexpected lookup results. The raw error text is sent to the node client.

Source

Thrown at pkg/capr/configserver/server.go:130

	if !r.secrets.Informer().HasSynced() || !r.clusterTokens.Informer().HasSynced() {
		if err := r.secrets.Informer().GetIndexer().Resync(); err != nil {
			logrus.Errorf("error re-syncing secrets informer in rke2configserver: %v", err)
		}
		if err := r.clusterTokens.Informer().GetIndexer().Resync(); err != nil {
			logrus.Errorf("error re-syncing clustertokens informer in rke2configserver: %v", err)
		}
		rw.WriteHeader(http.StatusUnauthorized)
		return
	}
	planSecret, secret, err := r.findSA(req)
	if apierrors.IsNotFound(err) {
		rw.WriteHeader(http.StatusUnauthorized)
		return
	} else if errors.Is(err, errRetrievalInvalidated) {
		rw.WriteHeader(http.StatusUnauthorized)
		return
	} else if err != nil {
		http.Error(rw, err.Error(), http.StatusInternalServerError)
		return
	} else if secret == nil || secret.Data[corev1.ServiceAccountTokenKey] == nil {
		rw.WriteHeader(http.StatusUnauthorized)
		return
	}

	switch req.URL.Path {
	case ConnectConfigYamlPath:
		r.connectConfigYaml(planSecret, secret.Namespace, rw)
	case ConnectAgent:
		r.connectAgent(planSecret, secret, rw, req)
	case ConnectClusterInfo:
		r.connectClusterInfo(secret, rw, req)
	}
}

func (r *RKE2ConfigServer) connectAgent(planSecret string, secret *corev1.Secret, rw http.ResponseWriter, req *http.Request) {
	var ca []byte

View on GitHub (pinned to 932558d4e6)

Solutions

1. Retry the connect request after a few seconds - most backing errors are transient.
2. Check rancher logs for the findSA error preceding this response.
3. Verify the plan secret and its service account still exist in the cluster's namespace.
4. Confirm rancher and the apiserver are not under sustained throttling (429s in logs).

curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $T" https://rancher/v-connect/agent # 401=token problem (fix auth), 500=backing store (retry)

for i := 0; i < N; i++ {
    resp, err := client.Do(req)
    if err == nil && resp.StatusCode == http.StatusOK { break }
    if resp != nil && resp.StatusCode == http.StatusUnauthorized { return fmt.Errorf("token rejected - do not retry") }
    time.Sleep(backoff(i))
}

When it happens

Trigger: system-agent presents a bearer token while the apiserver call behind the token/secret lookup fails with a timeout or throttle, or the backing informer caches return an error mid-provisioning.

Common situations: apiserver pressure during scale-up of many nodes; rancher restart while tokens are being rotated; a race where the service account is deleted between validation and plan-secret lookup.

Related errors

• InvalidType
• use POST for this endpoint
• cannot read request body: %v
• invalid data for auth store update
• error creating secret %s: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/59d8433fc68c32fa. Report an issue: GitHub.